yashsingh1/xdaforums huggingface dataset:
[XPERIA X10 Android Development] Umeaboy:
Also...... I don't know if you've read this, but in the README-file for fastbootloader you see this description:

The bootloader environment consists of a set of libraries that provide

various features and a couple small driver programs that build against

these libraries. The libraries used come from three categories --

generic (containing code useful to any bootloader), architecture

(containing code useful to a specific cpu, system-on-chip, etc), and

board (containing code useful to a single specific device)

For the purpose of this discussion, we will involve the fictional

companies Outstanding Electronics Manufacturing (OEM) and Silicon

Engineering Management, Inc (SEMI). OEM produces the quality Brick

mobile device using SEMI's 65002 ARM-based system-on-chip.

Common bootloader libraries and base architectures:

boot/include/boot headers

boot/libboot libboot.a

boot/libc libboot_c.a

boot/arch_armv6 libboot_arch_armv6.a

Architecture-specific libraries for SEMI 65002 SOC:

partner/semi/boot/include/65002 headers

partner/semi/boot/arch_65002 liboot_arch_65002.a

Device-specific library for OEM Brick phone:

partner/oem/brick/product_config.mk configuration

partner/oem/brick/boot libboot_board_brick.a

The actual bootloader:

boot/bootloader bootloader

The product_config.mk defines three important build variables:

DEVICE_BOOTLOADER_LIBS := \

libboot_board_brick.a \

libboot_arch_65002.a \

libboot_arch_armv6.a

DEVICE_BOOTLOADER_LINK_SCRIPT := \

partner/semi/boot/boot.ld

DEVICE_BOOTLOADER_INIT := \

partner/semi/boot/init.S

Which are used by the bootloader to specify which board and

architecture specific libraries to link against as well as what link

script and init.S to use

I hope that this helps somehow. If not, then OK.
[XPERIA X10 Android Development] Contrarian:
A friendly soul over at the x10 mini forum managed to get their hands on a prototype phone and remove the bootloader.

I hope this can help the developers in some way

http://xdaforums.com/showthread.php?p=8557090#post8557090
[XPERIA X10 Android Development] Bin4ry:
Prototypes analyse

Regards

Bin4ry
[XPERIA X10 Android Development] Bin4ry:
Spldump & Splwrite Source.

I made splwrite very fast and dirty, so somebody who knows C please look over and correct errors if you find some.

Also somebody can compile it please for me, because i'm on my netbook and compiling is no fun here :D

Regards

Bin4ry

EDIT:

After somebody has checked the code and compiled it, somebody with balls can try to write spldump from prototype (posted before) on his X10 :D (Warning: If it fails or the phone won't like the spldump, the phone is DEAD FOREVER)
[XPERIA X10 Android Development] sim-value:
The prototype loader is for the X10 Mini, or am I wrong?
[XPERIA X10 Android Development] MarylandCookie:
For the x10. Changes made to it using analysis from the prototype.
[XPERIA X10 Android Development] Bin4ry:
I think i missed that i only write it into memory and not onto nand. So somebody first has to correct my code (or just expand). [Thanks to biktor for the hint]

So now i'm off for ~1 week.

Regards

Bin4ry
[XPERIA X10 Android Development] wolfilein:
http://xdaforums.com/showthread.php?t=716360&highlight=kernel

here you find an info
[XPERIA X10 Android Development] MrPappy86:
If i have balls :D what i win with this?

I have a unlocked spl and able to flash a custom recovery?
[XPERIA X10 Android Development] maxrfon:
So ..

The spl dumps you guys read out is ram, just trashed ram blocks that left uncleared after device startup. The logical part exists in the first few tens bytes and then ON OFF.. and other trash, so i guess you are digging in a wrong direction. I have noticed this:

******************************************************************

ROM:00000100 MOV R0, #0

ROM:00000104 ADR R1, dword_11C

ROM:00000108 LDR R1, [R1]

ROM:0000010C ADR R2, dword_120

ROM:00000110 LDR R2, [R2]

ROM:00000114 ADR R4, off_124

ROM:00000118 LDR PC, [R4]

ROM:00000118 ; End of function sub_F0

ROM:00000118

ROM:00000118 ; ---------------------------------------------------------------------------

ROM:0000011C dword_11C DCD 0xF5DA6 ; DATA XREF: sub_F0+14o

ROM:00000120 dword_120 DCD 0x200100 ; DATA XREF: sub_F0+1Co

ROM:00000124 off_124 DCD 0x208000 ; DATA XREF: sub_F0+24o

******************************************************************

So the following means that PC should get get to 0x208000

ROM:00000114 ADR R4, off_124

ROM:00000118 LDR PC, [R4] ;off_124 DCD 0x208000

So if you tune a bit and dig those addresses from 0x200000 then probably you can see some real code. Because all in the spl.bin files what i've seen here is only trash.

So how would it help you - no idea.

Please someone try to read from higher addresses or bigger data range and then we will see.
[XPERIA X10 Android Development] Bin4ry:
Thanks for the info :) Maybe somebody will recompile the source, you can easily extend the area which is read out in the source.

ATM i only have found some "old" recompile of SEMC mtd show module on my netbook. But like i said i cannot work this week on the project, because i'm not home and only on my netboot.

Take a look if you want, and someone please try to flash through my fastbootloader. The systempartition and tell us if you get Triangle or not (to see if the flash works or not)

Thanks

Bin4ry

NOTE:

THERE IS ALWAYS A CHANCE FOR BRICK! SO DON'T BLAME ME OR ANYONE IF YOUR DEVICE IS DEAD AFTER TESTING!
[XPERIA X10 Android Development] Bin4ry:
Hm, maybe you need drivers, i have not much knowledge of Windows.

For linux i can tell you that you just need to enable udev rules normally and then fastboot should work.

Maybe someone must add the PID Line to the driver file or something. (I don't know if its easy like that, because i'm not a windows guy :D )

Regards

Bin4ry
[XPERIA X10 Android Development] HunteronX:
I think you have to go to 'Control Panel', 'System', 'Advanced system settings', and then 'Environment Variables'.

Finally add the 'DriveLetter\androidsdkfolder\tools' directory to 'System variables', 'Path'.

E.g.

C:\Android\android-sdk-windows\tools

Then as you try to use fastboot, the drivers should be found via Windows update, and installed automatically.
[XPERIA X10 Android Development] biktor_gj:
BE EXTRA CAREFUL. I was lucky (well, sort of, didn't risk much to say the truth as I knew more or less where I was going ) and trashed the system partition. You might overwrite the bootloader, the TA, AMSS or other critical area, rendering the phone unusable just by trying. Don't say I didn't warn you!
[XPERIA X10 Android Development] wolfilein:
Can't you rescue the phone over jtag or other flash hadware?
[XPERIA X10 Android Development] biktor_gj:
well, the nand is glued to the mainboard on every side to avoid tampering, and jtag headers are still unknown (i killed a board trying) and you would need a software capable of writing back whatever you broke, and there arent full backups of the nand as reference...

So I guess the answer is if you have enough data and are smart enough to do it maybe, at this point, not possible imho..
[XPERIA X10 Android Development] wolfilein:
And i ve edit the fastbootdriver time agoi will upoload it
[XPERIA X10 Android Development] wolfilein:
http://www.4shared.com/get/-q_8gsOF/SDK16_USB_Galaxy.html

this shoul work for you
[XPERIA X10 Android Development] maxrfon:
Hey guys, who has splboot sources?

I need urgent, i have an idea and need to test.

I am with x10 mini. I want to read some mem region and i am set here.

Btw Bin4ray, can you post here the sources of more-mtd for me to test on the mini one?
[XPERIA X10 Android Development] biktor_gj:
Check this post:

http://xdaforums.com/showpost.php?p=7721227&postcount=180
[XPERIA X10 Android Development] maxrfon:
Thanks.. Got it.. Does not work what i need..

Someone told me the physical address where to S1_Boot resides, but i tried this address and it's pure RAM trash.

<REGION NAME="S1Boot" START_ADDRESS="0x8000000" END_ADDRESS="0x801FFFF" MID="0x0" />

So what could be done to read this area? I think this is physical address for the GSM part of the phone, but i believe they use shared memory (please correct me if i am wrong) with gsm part. Spl gives access to the RAM only, so the task is how to read the flash area?

I have made analysis of EMMA boot, it uses FF00FF00+cmd_ofset to access nand as well as internal firmware read the TA from same region, so if someone is good at nand, would be good to have a hand of help.
[XPERIA X10 Android Development] Bin4ry:
More-mtd sources.

Regards

Bin4ry
[XPERIA X10 Android Development] goroh_kun:
boot your custom SPL(Soft SPL)

hi, all

here is kernel module to boot your custom spl image.

you can try to boot soft spl.

fixed version

http://hotfile.com/dl/53988785/10acd7f/splboot_2.zip.html

insmod splboot.ko
cat /path/to/your/splimage > /proc/splboot/image
echo > /proc/splboot/boot

:)
[XPERIA X10 Android Development] goroh_kun:
hi, biktor_gj, jerpelea

I don't know in detail how SPL works in xperia.

just I wrote a kernel module to dump, modify and boot specific area :)

you can modify the source code, I hope it can help your analyze.

thanks info about it.

I'll try to analyze how SPL works.
[XPERIA X10 Android Development] goroh_kun:
hi, jerpelea

I dumped from 0x100000, and checked the image.

the area for 0x100000 seems used

as SMD(Shared memory device) information area.

you mean, therea is the bootloader code at 0x100000

and SMD info overwrite the bootloader image?
[XPERIA X10 Android Development] goroh_kun:
I uploaded fixed version.

I forgot to copy custom image at addr 0x100000- before reboot.

:p
[XPERIA X10 Android Development] Bin4ry:
my dump is like the others full of checks, lets look what we can do :)

Thanks for the great work goroh :)

Regards

Bin4ry
[XPERIA X10 Android Development] goroh_kun:
http://hotfile.com/dl/54055119/1a8816f/splboot_3.zip.html

I modified the splboot module to user able to choice spl start address and splsize.

like this

insmod splboot.ko spladdr=0x00000000 splsize=0x00100000

thanks.:)
[XPERIA X10 Android Development] Bin4ry:
Here is my spl Dump.

Just for info and comparision :)
[XPERIA X10 Android Development] jerpelea:
try to load nexus spl wich is qualcom spl

maybe we are lucky and se did not modify adresses

will look into it
[XPERIA X10 Android Development] Bin4ry:
N1 does not boot like it is ;) jerpelea and me tested :P

Regards
[XPERIA X10 Android Development] Vilam:
Binary ? Can I have a look at the stuff ?
[XPERIA X10 Android Development] jerpelea:
loader dump is wrong

latest used adress is 7fff0

so i think that

#define SPLSIZE 0x0007fff0 is corect value

i mofified the dumper to this new adress

(spl is same size as nexus one)
[XPERIA X10 Android Development] goroh_kun:
usbloader(fastboot host)

Hi, all

I ported the fastboot capable bootloader from Aurora Project.

http://hotfile.com/dl/54453419/cb34f87/splboot_4.zip.html

you can boot your kernel with the fastboot command.

This is test version. I disabled NAND erase/flash function.

:)

the zip file I uploaded includes source code, you can rebuild,

and customize. I'll next try to imprement auto boot function.

see you soon.

on xperia terminal.

insmod splboot.ko
cat usbloader > /proc/splboot/image
echo > /proc/splboot/boot

your PC command terminal.

>fastboot devices
? fastboot

>fastboot getvar product
product: ES209RA

>fastboot boot /path/to/your/boot.img

Reference

https://www.codeaurora.org/gitweb/q....git;a=tree;h=refs/heads/chromium;hb=chromium

https://www.codeaurora.org/gitweb/quic/chrome/?p=qcom/qsd8250_ffa.git;a=summary
[XPERIA X10 Android Development] biktor_gj:
hehe, just where I was going, nice goroh :)

I was trying LK though, legacy bootloader is nice too ;)
[XPERIA X10 Android Development] biktor_gj:
You cant flash it yet, just soft boot. And no, after bootloader is flashed you'll be abe to use jerpelea's recovery images or fastboot to flash whatever you want. Nice, huh? :)
[XPERIA X10 Android Development] jerpelea:
please Stop filing this thread with junk

we are tring to do something for you

but is hard to follow progress if you post junk

also please don't "quote" posts just to say thanks

if you have something to coment about an release just mention user

otherwise there will be several large posts hard to follow

@progress

cyanogen6 is ready (alpha stage with many things to fix,bt,wifi,phone,power management,gps)

if we release it now 1 of 100 will be able to boot it just to see that it boots (but is useless because not even phone is working)

bootloader is not stable and can not be autobooted or flashed now

thanks
[XPERIA X10 Android Development] biktor_gj:
MTD sort-of-working :)

About booting, almost there.

We know what happens, just need to fix it :P

Will post back with more progress when there is more progress!
[XPERIA X10 Android Development] biktor_gj:
Autoboot is just a matter of seting a variable to 1 on the bootloader. The probem is flashing without breaking anything, and the fact youll loose warranty and seus compatibility forever (which btw, for me, is a feature :D )

Good thing is youll be able to boot to recovery at will

Btw, keypad working: )
[XPERIA X10 Android Development] jerpelea:
here you go

an recovery to test it boots properly

1 is for se bl

1 is for qc bl

test with both
[XPERIA X10 Android Development] biktor_gj:
Nope, s1 loader goes to hell, so flash tool wont find the phone, and will need to use fastboot to flash, or do it from recovery....
[XPERIA X10 Android Development] jerpelea:
or flash back s1_loader with an special tool then flash with regular flash tool
[XPERIA X10 Android Development] maxrfon:
Ok thanks, can you please explain a bit, because i missed the whole story with fastboot, what it does?

How to access nand with it for reading?

And i am with x10 mini, so could you tell me what's the modification you made, so i could port your more-mtd to my mini sources..
[XPERIA X10 Android Development] Bin4ry:
Hi, i changed nothing. just digged in SEMC sources and compiled some stuff to module ;)

I will look for mini in their sources

It just adds some more mtd's while searching for the partition names. But i think the partitions are not good at all (like goroh's sometime ago).

With the fastbootloader you should be able to flash directly to nand, but beware it flahes a little widely onto the nand, so if you overwrite some impornant stuff you will be bricked :/

BTW: Do you have any idea about a module to open qcom diag mode?
[XPERIA X10 Android Development] maxrfon:
Hi.

I do not need to flash nand now, i need to read it out, analyse and then we can see what we can do. So if you can point me to a tut of how to do it i would appreciate.

Ans yes, to enable diag in x10(not mini) you need to reflash it with diag image from goroh, there is no other way, since X10 is JTAG and DIAG access protected.

With x10 mini things are easier, at least now.. It just should be rooted.

Go to adb shell and do next:

su

echo 0146 > /sys/devices/platform/msm_hsusb_periphera/composition

Bump and you have diag, but no dirvers. You need to modify any existing driver and add VIDxxxx/PIDxxxx&M02 to be treated as diag.

And all diag commands except some basic(read here "useless") ones are deleted by SE.

The RED firmware has no simlock handler, so whatever you do - you can't get access to the simlock data. As well as flash mode. When you issue flash mode command it resets...

So please could you point me to the fastbootloader usage?

And i recompiled more-mtd for mini, but i don't get any additional devices and i forgot how to use goroh's version.. How to cat the blocks?
[XPERIA X10 Android Development] maxrfon:
One more small question:

I see in fastboot files there are header with ANDROID! mark. Where is this header explained?

41 4E 44 52 4F 49 44 21 44 04 00 00 00 80 00 10
01 00 00 00 00 00 00 11 00 00 00 00 00 00 F0 10
[XPERIA X10 Android Development] biktor_gj:
It's on bootimg.h: (android source: system/core/mkbootimg/bootimg.h)

#ifndef _BOOT_IMAGE_H_
#define _BOOT_IMAGE_H_

typedef struct boot_img_hdr boot_img_hdr;

#define BOOT_MAGIC "ANDROID!"
#define BOOT_MAGIC_SIZE 8
#define BOOT_NAME_SIZE 16
#define BOOT_ARGS_SIZE 512

struct boot_img_hdr
{
unsigned char magic[BOOT_MAGIC_SIZE];

unsigned kernel_size; /* size in bytes */
unsigned kernel_addr; /* physical load addr */

unsigned ramdisk_size; /* size in bytes */
unsigned ramdisk_addr; /* physical load addr */

unsigned second_size; /* size in bytes */
unsigned second_addr; /* physical load addr */

unsigned tags_addr; /* physical addr for kernel tags */
unsigned page_size; /* flash page size we assume */
unsigned unused[2]; /* future expansion: should be 0 */

unsigned char name[BOOT_NAME_SIZE]; /* asciiz product name */

unsigned char cmdline[BOOT_ARGS_SIZE];

unsigned id[8]; /* timestamp / checksum / sha1 / etc */
};
[XPERIA X10 Android Development] biktor_gj:
The problem with fastboot loader is it's NOT going to work on the x10 Mini. It's a different architecture, (QSD8k vs msm76xx if I recall). You can recompile it for the msm7 platform, then patch the video driver using SE's kernel sources as a guide, and (maybe) (without looking too much into it) disable the sysini instructions to avoiding the cpu to be resetted when the bootloader starts.

From that, patch and patch and patch until you get usb working, and also patch the nand driver to make the nand IC recognized. You should not need to port RPC driver, goroh did that to allow a kernel to boot without properly shutting down/rebooting the mcpu (which noone knows how to do btw) and the essential SoC support is already there since most android manufacturers are using qualcomm soc's on their platforms, but there is extensive patching that needs to be done to make it 'work'. The function I'm working on for reading the flash should be easy to port (just a copy paste and rearrange partitions), and the modded fastboot binary should work too with not too many problems though.

BTW, what goroh did was modify the mcpu rpc driver on the bootdiag image to force it into diagnostic mode. Which is NOT engineering mode which would be nice to see working (bin4ry, you remember that strange Product_ID we had when breaking some fota update on purpose? I think that was engineering mode, it's a shame we didn't get it to work again...)
[XPERIA X10 Android Development] maxrfon:
Yeah! Thanks. I will try then on my X10, whatever..

Please point me then to the X10 manual to read nand.

I can force any Product_ID from the list from MSM_HSUSB confg, it's not a problem.

But i never seen engineering product ids in any of SE.

They have S1Boot for that purpose - Red, Brown... etc.. So the Brown is Engineering.

Anyway, if you can help me on my task (to read the nand x10(normal)) i would appreciate it...
[XPERIA X10 Android Development] vegard_e:
From X10 mini pro boot:

<5>[ 2.326743] Creating 4 MTD partitions on "msm_nand":
<5>[ 2.331706] 0x000002c00000-0x00000fa00000 : "system"
<5>[ 2.337928] 0x000012c00000-0x00001ffc0000 : "userdata"
<5>[ 2.342713] 0x00000fa00000-0x000012c00000 : "cache"
<5>[ 2.347518] 0x00001ffc0000-0x000020000000 : "appslog"

I then edited more-mtd.c to create a partition of the only region left unpartitioned:

<5>[ 4560.250943] Creating 1 MTD partitions on "msm_nand_ex":
<5>[ 4560.250988] 0x000000000000-0x000002c00000 : "foo"

Sadly, however, there is absolutely no data in that region, it reads as all 1's.

The same goes for the appslog-partition, and the other three are mounted as yaffs2.

The way I see this is that the bootloader does not reside in NAND.
[XPERIA X10 Android Development] maxrfon:
Well, it resides in nand or flash, but the flash is not connected to android CPU(8x50). I guess it's "chip selected" to be working with gsm cpu (6xxx) only. And that's why to access it we need to do it from usbloader.
[XPERIA X10 Android Development] maxrfon:
There is one more idea:

Nand has Read protect register, so the memory could just be locked from reading outside.

Second (imho) the oob blocks are marked in the way that MTD does not recognize it and therefore we get only FFs. So the time to check for masters.. Pity Goroh does not show up, we would check my theories..
[XPERIA X10 Android Development] maxrfon:
Samsung MCP nand

So since i am here alone talking to myself i will use this page as my personal BLOG lol!

Anyway, i wanted to note that the NAND ic is MCP/Onenand, custom developed flash. According to the docs that do not lie:

<FLASH_REGIONS>
<REGION NAME="FLASH" START_ADDRESS="0x8000000" END_ADDRESS="0x47FFFFFF" MID="0x0" />
<REGION NAME="S1Boot" START_ADDRESS="0x8000000" END_ADDRESS="0x801FFFF" MID="0x0" />
<REGION NAME="Complete_Flash_(1024MB)" START_ADDRESS="0x8000000" END_ADDRESS="0x47FFFFFF" MID="0x0" />
<REGION NAME="Complete_Andrioid_SW_(1023MB)" START_ADDRESS="0x8200000" END_ADDRESS="0x47FFFFFF" MID="0x0" />
</FLASH_REGIONS>

So i am sure it is accessible from bootloader, but after android starts we do not have access to the nand.

I need goroh or someone who understands, to boot from splboot and try to port some loader to test my version. If we succeed we will have nice update :)

Any hand?

To PM please.
[XPERIA X10 Android Development] Bin4ry:
Im willing to help but atm i'm in university. Will be home in ~8 hours.

So what do you exactly need? Atm im trying to mod fastbootloader more, so that it will detect partitions automated.
[XPERIA X10 Android Development] mad-murdock:
First of all, you are not alone. Following this thread, but didnt wanna troll... I am not (yet) an android dev, but startet linux 1996, got knowledge of c and that stuff. Best things last: my FATHER got an xperia ^^ so, if you need help, here I am. Having access to the device at least once a day - he lives nearby.
[XPERIA X10 Android Development] maxrfon:
Hi,

You don't have to do too much. All we need is system to be booted with less load on it with splboot.

That is we need to gain access to another chip, which could be selected by issuing command execute with data 02 to address [FLASH_BASE+0x0c], for example 0xA0A0000C.

Then you put flash config like AA000000. This will turn the other flash on. And then try to read a few pages to see what data is there.

Nand commands are common, so 0x32 is to read page. At the offset [FLASH_BASE+0x100] is the buffer where nand returns the data read.

Well this will give a clue of what to do next.

If you need sample of how to communicate with nand PM me.
[XPERIA X10 Android Development] biktor_gj:
The fact that I dont reply much doesnt mean Im dead: )

Atm Im rewriting the download and flash on fastboot so it uploads and dumps the partition on the pc...hence why havent replied to your post on how you can read partitions with fastboot (because unless you code it yourself since mine is not ready yet, you cant for now)

Regards!

EDIT: BTW, Don't know the X10 mini, but the normal (big) X10 uses a nand chip from Micron. Either way, it can be read having direct access to the nand, which we have on usbloader, so even if it's hard, it's easier than loading a nand kernel module on top of an already running nand kernel module and hoping for the best :)
[XPERIA X10 Android Development] maxrfon:
Yes i am talking about the big x10.

The type of nand it uses is not important now. The addresses i showed above are for both, mini and big x10. So i do not see anything in the nand read via MTD (and it should not happen).

Can you point me how can i read nand via usbloader? Let's do something!

Edit: i never mean to load some modules on top of some modules :)

I mean to run usbloader and force it to execute small program that reads the nand.

Then we can try to write the nand and little by little we get to the S1boot and patch it to accept unsigned firmwares.